purkka

You can do this way easier by just copying the HTML/CSS and modifying what you need. Going through Figma is entirely unnecessary for making a scam site.

All Apple mobile devices I've used have had some form of low-level forced reboot method, akin to holding down your PC's power button. Though I can't say whether it's also something one could subvert with a BootROM exploit.

https://support.apple.com/guide/iphone/force-restart-iphone-...

Nope, the kernel can load static ELF binaries. ld.so is only needed for dynamically linked binaries, and in fact many Go applications (for example, as they're statically linked) ship as containers with nothing but the single binary.

I've found this to be effective as well. Claude generally immediately identifies the stupid code pattern it used and tries to fix it (with somewhat varying results).

90% of 30% of total energy use. So, actually 27%. What a title.

I wonder how this compares to GrapheneOS in practice.

>Operated by Murena, your Murena Workspace account @murena.io is at the centre of the ecosystem, allowing to store, back up and retrieve your data safely on remote servers.

This sounds like their version is somewhat married to Murena. While probably better than Google, still not independent.

They're also advertising features such as "hiding your IP address [...] when you feel like it" – which sounds a lot like a VPN – without mentioning much about who the traffic is going through or how they might log it.

The Europeans have already cooperated with Americans so that each could read each other's citizens' private messaging which would be illegal for the locals.

Keeping the data overseas by design would just make this easier.

https://en.wikipedia.org/wiki/Operation_Trojan_Shield

Greylisting is great until it delays your email login/signup verification codes for 20 minutes. Especially if they expire in 15.

I guess this only shows how email is used for entirely orthogonal purposes now.

Per the tweet linked in the article there were also random bans in addition to the ban feed shitposting.

https://x.com/KingGeorge/status/2004902566434668686

Python has LiteralString for this exact purpose. It's only on the type checker level, but type checking should be part of most modern Python workflows anyway. I've seen DB libraries use this a lot for SQL parameters.

https://typing.python.org/en/latest/spec/literal.html#litera...

It does, especially at the scale of operating systems.

Bugs and vulnerabilities are always being found, with fewer and fewer people in the pool that might even theoretically want to pay for fixing them.

Also, hardware does deteriorate, and the story is the same for adding software support for whatever is currently available in hardware.

Based on the various benchmarks linked here and in the OP, the name feels justifiable. "Mini" models tend to be a lot worse compared to the base model than this one seems to be.

> Are you aware that here you are arguing for criminal sanctions on the order of 10 years in prison, for writing a letter?

It's about writing a letter that can result in someone else receiving criminal sanctions on the order of 10 years in prison, when that someone might not have even written a letter.

Provably false is essential here.

> Unlike GNU Emacs, JOVE does not support UTF-8.

If this is still true in the latest versions, I find it pretty amazing that something like this has been maintained all the way until 2023.

Generally, yes: https://reproducible-builds.org/docs/timestamps/

Since the build is reproducible, it should not matter when it was built. If you want to trace a build back to its source, there are much better ways than a timestamp.

"Security through obscurity" can definitely be defined in a meaningful way.

The opposite of "bad security through obscurity" is using completely public and standard mechanisms/protocols/algorithms such as TLS, PGP or pin tumbler locks. The security then comes from the keys and other secrets, which are chosen from the space permitted by the mechanism with sufficient entropy or other desirable properties.

The line is drawn between obscuring the mechanism, which is designed to have measurable security properties (cryptographic strength, enumeration prevention, lock security pins), and obscuring the keys that are essentially just random hidden information.

Obscuring the mechanism provides some security as well, sure, but a public mechanism can be publicly verified to provide security based only on secret keys.

This is a Gmail-specific feature. I'd guess it's there for user convenience and some protection against typos (accidental or malicious).

https://support.google.com/mail/answer/7436150?hl=en

Came across this today. Especially the collection highlights on Wikipedia [0] really made my day.

[0]: https://en.wikipedia.org/wiki/Museum_of_Bad_Art#Collection_h...

> The case I was making, is that weakhash(stronghash(m)) has the security of weakhash, no matter how strong stronghash is.

I'll have to disagree. There are no known collision attacks against SHA-1(SHA-3(M)), so in the applied case, a combination can be more secure for some properties, even if it isn't in the theoretical case.

> H0(H1(m)) has the security of just H0. Hashes are not made to protect the content of m, but instead made to test the integrity of m. As such, a flaw in H0 will break the security guarantee, no matter how secure H1 is.

But this isn't true for all flaws. For example, even with the collision attacks against SHA-1, I don't think they're even remotely close to enabling a collision for SHA-1(some_other_hash(M)).

Similarly, HMAC-SHA-1 is still considered secure, as it's effectively SHA-1-X(SHA-1-Y(M)), where SHA-1-X and SHA-1-Y are just SHA-1 with different starting states.

So there's some value to be found in nesting hashes.

[1]: https://en.wikipedia.org/wiki/HMAC#Definition

I have to wonder how a company at the scale of GitHub can be so bad at keeping track of their status.

Now 4 out of 10 services are marked as "Incident", yet most of the others are also completely dead.

The flipside of this is availability. Your T2 coprocessor is now permanently tied to your data. This means if the chip dies, there's no recovery unless you have a backup encrypted with a separate key (with its own confidentiality/availability tradeoff).

(And if anything else on your motherboard dies, Apple's official answer is "you're f*cked", since they refuse to do board-level repair.)

For the threat model of most users, where hardware-based targeted attacks aren't a big concern, this is a bad tradeoff.

I'd guess what they mean is there are two clusters with some clear distinguishing properties, and perhaps some resulting implications for treatment.

This isn't to say they wouldn't use "regular width" roads during wartime if necessary. No point taking that risk during peacetime.

Apple could still use keys to validate the module is genuine. Then you just need to trust Apple to not release compromised modules. They need to just stop pairing the individual modules to the phone.

Interestingly, no kernel vulnerability or anything is mentioned.

As far as I know, any parsing code for iMessages should run within the BlastDoor sandbox – is there another vulnerability in the chain that is not reported here?

The difference in gravity around the Earth is small enough that the pendulums would be within a couple percent. (Wikipedia claims a measured difference of 0.3% from the time.)

Assuming the second was also quite accurate, the seconds pendulum wouldn't be too far from its current definition given that g ≈ π² to within ~1 % in modern units.

Given that the second is an older unit [0] than the redefinition of the metre, and defined based on "nice" subdivisions of the day, it would seem that there's still a bit of a coincidence there.

Since the metre was previously defined by the seconds pendulum, it was entirely defined by the definition of a second and the value of g. From the equations, 1 m = 1 s² × g / π².

While this makes g ≈ π² straightforward, it seems coincidental that the Earth's circumference was close enough to 40 000 km that the redefinition of the metre was a nice power or 10 without too much change to the metre.

[0]: Late 16th century, based on https://en.wikipedia.org/wiki/Second#Fraction_of_solar_day

Perhaps there would be less demand for chop shops if Apple didn't try their hardest to prevent repair shops from buying their slightly customized chips new and genuine from the manufacturers.

In our current project with a TS frontend and Python backend, we use an OpenAPI schema as the source of truth and openapi-typescript-codegen [0] to interface with it on the client side. While not perfect, it provides a very nice interface to our API with request/response typings.

I also wrote a 10-line mock API wrapper that you can call as mockApi<SomeService["operationName"]>((request) => response), and it will type-check that your mock function implements the API correctly and return a function that looks exactly like the real API function.

[0]: https://github.com/ferdikoomen/openapi-typescript-codegen